Ngaf Feautures for SSH AND RDP

Hi All,

Good Day!


Feautures want to protect internal host from SSH and RDP Brute force attack which function of ngaf can meet his requirements?

1.APT Detection
2.RT Vulnerability Scanner
3.Web App Protection
4.IPS

To protect internal hosts from SSH and RDP brute force attacks, the feature of Intrusion Prevention System (IPS) in (NGAF) would be the most suitable. IPS monitors network traffic for malicious activity and can detect and block brute force attacks targeting SSH and RDP protocols by analyzing patterns and behaviors associated with such attacks in real-time. This proactive approach helps prevent unauthorized access attempts and strengthens the security posture of internal hosts against brute force attacks...

The most effective Sangfor NGAF function to protect internal hosts from SSH and RDP brute-force attacks is:

4. IPS (Intrusion Prevention System)

Here's why IPS is the best choice for this scenario:

    Brute-force attack detection: IPS is designed to monitor network traffic for malicious activity, including brute-force login attempts. It can identify patterns of repeated failed login attempts from a single source, which is a hallmark of brute-force attacks.

    Blocking malicious traffic: Once IPS detects a brute-force attack, it can take action to block the attacker's IP address or throttle login attempts after a certain number of failures. This significantly reduces the risk of successful unauthorized access.

    Real-time protection: IPS operates in real-time, constantly analyzing network traffic for threats. This ensures immediate response to ongoing brute-force attacks.

While the other options you mentioned offer valuable security features, they are not directly suited for this specific task:

    APT Detection: APT (Advanced Persistent Threat) detection focuses on identifying sophisticated, targeted attacks, which may not involve brute-force methods.

    RT Vulnerability Scanner: This function identifies vulnerabilities in systems and applications, but it doesn't actively block attacks that exploit those vulnerabilities.

    Web App Protection: This feature is designed to secure web applications from attacks, not SSH or RDP services typically used for remote server access.

By implementing Sangfor NGAF's IPS and configuring it with appropriate rules for SSH and RDP traffic, you can significantly strengthen your defenses against brute-force attacks and protect your internal hosts.

My suggestion is that you can run the Intrusion Prevention System (IPS) feature in NGAF. This will protect your server from attackers.

I sugest you to use IPS -  Intrusion Prevention System on NGAF, but i sugest that your servers or devices that have SSH and RDP port open to have some policies to prevent Brute force attack in case...

It is suggested to implement an Intrusion Prevention System (IPS) in your NGAF solution. Please consider configuring your firewall to restrict access to these ports only for authorized sources and implementing strong password policies to further enhance security.

The most relevant function in a Next-Generation Firewall (NGAF) would be the Intrusion Prevention System (IPS).

IPS is designed to monitor network traffic and identify potential threats, including brute-force attacks targeting SSH and RDP ports. It can analyze traffic patterns and block malicious activities based on predefined rules or signatures. By implementing an IPS, you can effectively shield your internal hosts from brute-force attacks.

Hi, i suggest you to safeguard your internal systems from brute force attacks targeting SSH and RDP, with the Intrusion Prevention System (IPS) feature in NGAF is essential. It identifies these attacks within your network traffic and halts them. Although other features such as APT detection and web application protection are also crucial, the IPS is specifically designed to thwart these types of attacks.

Intrusion Prevention System (IPS)

apply firewall and IPS system.

To protect your internal systems from brute force attacks on SSH and RDP, you need the Intrusion Prevention System (IPS) feature in NGAF. It spots these attacks in your network traffic and stops them. While other features like APT detection and web app protection are vital too, IPS focuses directly on stopping these kinds of attacks.